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DETAILED ACTION 

1 . This is in response to the amendment on 21 February 2008. 

2. Claims 1-38 and 40-45 are pending in the application. 

3. Claims 1-38 and 40-45 have been rejected. 

4. Claim 39 has been cancelled. 

Response to Amendment 

5. The examiner approves of the amendment made to claims 1 and 10. The applicant has 
removed the expression "most active" from the claims. The examiner withdraws the rejection 
under 35 U.S.C. 112, second paragraph, as being indefinite for failing to particularly point out 
and distinctly claim the subject matter which applicant regards as the invention. The applicant 
has cancelled claim 39. Since the claim has been cancelled, there are no issues regarding 35 
U.S.C. 112, second paragraph. 

Response to Arguments 

6. Applicant's arguments with respect to claims 1-38 and 40-45 have been considered but are 
moot in view of the new ground(s) of rejection. 

Claim Rejections - 35 USC § 112 
The following is a quotation of the second paragraph of 35 U.S.C. 1 12: 

The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the 
subject matter which the applicant regards as his invention. 

7. Claims 1-38 and 40-45 are rejected under 35 U.S.C. 112, second paragraph, as being 
indefinite for failing to particularly point out and distinctly claim the subject matter which 
applicant regards as the invention. 
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Claim 1 recites the limitation "said user" in the claim. There is insufficient antecedent 
basis for this limitation in the claim. 

Claim Rejections - 35 USC § 102 

The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the 
basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(c) the invention was described in ( 1 ) an application for patent, published under section 122(b), by another filed 
in the United States before the invention by the applicant for patent or (2) a patent granted on an application for 
patent by another tiled in the United States before the invention by the applicant for patent, except that an 
international application filed under the treaty defined in section 351(a) shall have the effects for purposes of this 
subsection of an application filed in the United States only if the international application designated the United 
States and was published under Article 21(2) of such treaty in the English language. 

8. Claims 1-31, 33-38 and 40-45 are rejected under 35 U.S.C. 102(e) as being anticipated by 
Parish et al U.S. Patent No. 7,310,818 Bl (hereinafter Parish). 

As to claim 1, Parish discloses a computer implemented method providing software 
viruses infection information in real time, the method comprising following steps: 

a) providing a computer virus utility program to a plurality of users 
distributed around different locations each of them operating at least one local 
computer (i.e. Parish discloses that computer 24 includes or has access to a virus 
scanning application such as McAfee's VSHIELD, ACTIVESHIELD, SCAN 
NOW or VIRUSSCAN brand programs, or anti-virus applications described in 
U.S. Pat. No. 6,029,256, issued Feb. 22, 2000 or U.S. Pat. No. 6,035,423 issued 
Mar. 7, 2000, which are incorporated herein by reference in their entirety, or any 
other suitable anti-virus program. The virus scanning application preferably 
contains an update agent which is resident in the background of the computer 
system and polls for updates at a set interval) [column 5, lines 5-13]; 
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b) obtaining information about geographical location of each of the local 
computers (i.e. Parish discloses the top ten viruses are also reported for different 
time periods and geographic locations. The present invention allows users to 
collect information on the prevalence, commonality, and locations of specific 
viruses. The examples below show the data presented in the form of a virus map, 
however, it is to be understood that the data may be presented in other formats 
(e.g., tables, graphs, charts), without departing from the scope of the invention) 
[column 4, lines 34-38]; 

c) carrying out, using the computer virus utility program, in response to a 
petition of the user, at least a computer virus search or scanning operation 
covering at least a part of at least one hard disk of the local computer or at least a 
part of a unit supporting information connected or connectable to the local 
computer (i.e. Parish discloses the virus scanning application may be installed on 
the user computer 24 by a disk or CD-ROM, or downloaded directly from the 
Internet, for example. The virus scanning application may also be accessed 
through an anti-virus web site that is configured to scan a remote computer 
without installing the virus scanning application locally. It is to be understood that 
the virus scanning may be performed on a system different than the one described 
herein without departing from the scope of the invention) [column 5, lines 19-25]; 

d) issuing a report containing the results of the computer virus search or 
scanning operation on the local computer including information about detected 
computer viruses and making available the results of the report through a 
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communication network along with at least data of the geographical location of 
the local computer, to a center (i.e. Parish discloses the results of the virus scans 
are sent from user computers 24 to system 20. The scan results may be collected 
at the same web server that is used to scan computer 24 or the computer may be 
configured to automatically report the results of the virus scanning if a local virus 
scan is performed. A user may, for example, subscribe to a program offered on an 
anti-virus web site that allows it to use its scanning software in return for use of 
data collected during virus scanning operations. The computer 24 may also 
perform a virus scan operation using an application installed on its hard drive and 
connect to the Internet and send a report containing the results of the scan after 
each virus scan operation or whenever the computer is in communication with the 
web site collecting the data) [column 5, lines 27-39]; 

e) processing at the center a plurality of reports received from different 
local computers and allocating the detected computer viruses in geographical 
areas [column 5, lines 27-39]; and 

f) making available information about the spread of at least one of the 
computer viruses at a given time in a series of selectable geographical areas 
corresponding to the different locations of step a) (i.e. Parish discloses The virus 
map may include, for example, statistics for 165 countries and be configured for 
interactive use (e.g., allow a user to zoom in or pan out on specific geographic 
areas, or point to and click on a specific country in the map and have statistics 
pop-up). Data is preferably collected 24 hours a day, seven days a week. The data 



Application/Control Number: 10/688,012 Page 6 

Art Unit: 2131 

may be aggregated every twenty minutes, for example, to provide near real time 
data on the relative prevalence of viruses worldwide) [column 9, lines 51-58]. 
As to claim 2, Parish discloses that the step a) of providing the computer virus utility 
program is carried out on line or off line (i.e. Parish discloses that the computer virus utility 
program is carried out online) [column 5, lines 19-25]. 

As to claim 3, Parish discloses that the steps a) and b) are performed sequentially at any 
given order [column 5, lines 19-39]. 

As to claim 4, Parish discloses that the computer virus utility program is anti-virus 
software (i.e. Parish discloses that computer 24 includes or has access to a virus scanning 
application such as McAfee's VSHIELD, AC1WESHIELD, SCAN NOW or VIRUSSCAN 
brand programs) [column 5, lines 5-13]. 

As to claim 5, Parish discloses that if any computer virus is detected a virus cleaning and 
file and system repair operation is performed at least on a scanned part of the computer providing 
the detection (i.e. Parish discloses that McAfee's VSHIELD is capable of cleaning) [column 2, 
lines 43-46]. 

As to claim 6, Parish discloses that the information made available at step f) is 
periodically updated [0355-0357]. 

As to claim 7, Parish discloses that the information provided at step f) is made available 
to any user of a computer through a communication network (i.e. Parish discloses that data is 
preferably collected 24 hours a day, seven days a week. The data may be aggregated every 
twenty minutes, for example, to provide near real time data on the relative prevalence of viruses 
worldwide) [column 9, lines 51-58]. 
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As to claim 8, Parish discloses that the information provided at the step d) further 
includes the number of times that a detected virus appears in the computer detection operation of 
step c) [0142-0143]. 

As to claim 9, Parish discloses that the information provided at the step f) further includes 
the percentage of infected computers at a selected geographical area (i.e. figure 9 shows a view 
with the select map pull down menu replaced with a top ten list of viruses) [column 9, lines 51- 
58]. 

As to claim 10, Parish discloses that the information provided at the step f) further 
includes a trend of spread of some of the detected computer virus at any given geographical area 
during an immediate preceding period of time [column 9, lines 51-58]. 

As to claim 1 1 , Parish discloses that the computer virus search or scanning operation of 
step c) is performed after a request of permission to the user (i.e. When one of the subscriber 
servers 30 receives a request for a virus map (step 114), it compares the date and time of the 
LastUpdate table and if it is different from the Current Date/Time it uses the new virus data to 
update the map (steps 116 and 118). FIGS. 4, 5, 6a, 6b, 7a, 7b, 7c, and 7d illustrate additional 
details of the process shown in FIG. 3.) [column 8, lines 1-26]. 

As to claim 12, Parish discloses that the report issued at step d), also includes a definite 
time when the at least a computer virus search or scanning operation is performed (FIG. 5 
illustrates details of the process for aggregating scan results by country. At step 150 a date and 
time are calculated by subtracting 24 hours from the Current Date /Time. This is also done to 
calculate a new date and time by subtracting 7 days from the Current Date /Time and a new date 
time by subtracting 30 days from the Current Date /Time (steps 152 and 154). Next, all entries 
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from the Viruses by country table and Virusesbycontinent table are deleted (steps 156 and 
158)) [column 8, lines 42-58]. 

As to claim 13, Parish discloses that the making available the result of the report at step 
d) to a center is done preserving anonymity of the user [column 9, lines 51-58]. 

As to claim 14, Parish discloses that the step c) is performed on the whole of the at least 
one hard disk or on the whole of all hard disks of the local computer that can be selected by the 
user (In the example shown in FIG. 1, user computers 22 are used to access the virus map and 
user computers 24 are used to report viruses identified during virus scanning. It is to be 
understood that the same computers may be configured to report virus scan results and access the 
virus maps and any number of computers may be used to report virus scan results and view the 
virus map and associated data. The user computers 22, 24 may be a stand-alone desktop 
computer, laptop computer or a handheld device (e.g., personal digital assistant (PDA) or mobile 
phone), for example. The computers 22, 24 may be client computers coupled to an Internet 
service provider over a SLIP (Serial Line Interface Protocol) or PPP (Point to Point Protocol) 
connection. The Internet service provider is, in turn, coupled to the Internet, the client computer 
thereby having the ability to send and receive information to other nodes on the Internet using a 
TCP/IP protocol (Transmission Control Protocol/Internet Protocol) [column 4 line 53 to column 
5 line 2]. 

As to claim 15, Parish discloses that the step c) is performed on an area interchanging 
messages of the local computer [column 5, lines 26-39]. 

As to claim 16, Parish discloses that the step c) is carried out on one or more files of the 
local computer [column 5, lines 19-25]. 
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As to claim 17, Parish discloses that the step c) also includes an heuristic exploration of 
the local computer in order to detect some files suspected to be infected, the results being also 
included as suspected files in the issued report [column 6, lines 32-46]. 

As to claim 18, Parish discloses that the report issued at step d) further includes the 
definite time at which the report issued at step d) was sent by the center [column 8, lines 42-58]. 

As to claim 19, Parish discloses that the report issued at step d) further includes the 
definite time at which the virus search or scanning operation ended [column 8, lines 42-58]. 

As to claim 20, Parish discloses that the step e) further includes evaluate for each of the 
geographical areas the number, name and degree of spreading of detected computer viruses or 
files and number of them suspected to be infected [column 8, lines 27-41]. 

As to claim 21, Parish discloses that the plurality of local computers are distributed 
around a wide geographical area [column 9, lines 51-67]. 

As to claim 22, Parish discloses that the plurality of local computers are distributed 
around the world [column 9, lines 51-67]. 

As to claim 23, Parish discloses that the communication network is a global network such 
as the Internet [column 5, lines 51-62]. 

As to claim 24, Parish discloses that the communication network is a particular network 
such as a large company network [column 9, lines 51-67]. 

As to claim 25, Parish discloses that the computer virus search or scanning operation of 
step c) comprises removing the detected computer virus from an infected file or files so that the 
file can be used again (i.e. Parish discloses that McAfee's VSHIELD is capable of cleaning) 
[column 2, lines 43-46]. 
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As to claim 26, Parish discloses that the computer virus search or scanning operation of 
step c) comprises quarantining the infected file or files [column 5, lines 3-25]. 

As to claim 27, Parish discloses that the computer search or scanning operation of step c) 
comprises repair the adverse effects of the computer virus in the infected computer [column 2, 
lines 43-46]. 

As to claim 28, Parish discloses that the computer virus search or scanning operation of 
step c) comprises remove an infected file or files [column 9, lines 18-19]. 

As to claim 29, Parish discloses that the computer virus utility program is periodically 
updated including special anti-virus tools to fight against reported new active computer virus 
detected [column 5, lines 3-25]. 

As to claim 30, Parish discloses that the computer virus utility program loaded in the 
local computers includes a communication program [column 5, lines 3-25]. 

As to claim 31, Parish discloses that the issued reports are being sent using the 
communication program [column 5, lines 26-39]. 

As to claim 33, Parish discloses that the issued reports include in addition to the number 
and name of computer virus found, the number and kind of files infected [see figures 10-12]. 

As to claim 34, Parish discloses that the periodically updated information of step f) is 
renewed and issued as soon as new batches of reports from any particular geographical area are 
processed by the center at step e) (The publisher database server 34 includes an aggregation 
application configured to aggregate the virus scan results at scheduled intervals (e.g., less than 
one hour or less than thirty minutes). When the aggregation is complete a virus database (e.g., a 
one-row table) is updated with the Tast update date' and the data is replicated out to the 
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subscriber servers 30 to create virus database within the subscriber server. The virus map 
application monitors this virus database, and when it changes, it invalidates all of the data layers 
of the virus map. When a user requests a data layer to view, the virus map application first 
checks to see if it is valid. If the data is invalid, it gets new data from the subscriber server 
database. This results in the data only being loaded for use by the virus map application when it 
is needed. Once loaded, it is cached until it becomes invalid) [column 6, lines 32-46]. 

As to claim 35, Parish discloses that the periodically updated information of step f) is 
renewed each predetermined period of time [column 5, lines 27-39]. 

As to claim 36, Parish discloses that the process of step e) at the center includes statistic 
operations of the data from the plurality of issued reports received [column 9, lines 51-55]. 

As to claim 37, Parish discloses that the information of the step f) is provided from a 
Website [column 5, lines 3-25]. 

As to claim 38, Parish discloses that the Website is a site further providing anti-virus 
tools for the users [column 5, lines 5-13]. 

As to claim 40, Parish discloses that a Web browser is used to reach the Website in order 
to obtain the information or to download a computer virus utility program [column 5, lines 26- 
39]. 

As to claim 41, Parish discloses that a special software utility program is used to reach 
the Website in order to obtain the information [column 5, lines 26-39]. 

As to claim 42, Parish discloses that the on line provision involves downloading a 
computer virus utility program from a site of a remote provider [column 5, lines 5-13]. 
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As to claim 43, Parish discloses that the downloaded computer virus utility program 
resides only temporally in the local computers [column 5, lines 5-13]. 

As to claim 44, Parish discloses that the downloaded computer virus utility program 
resides permanently in the local computers [column 5, lines 5-13]. 

As to claim 45, Parish discloses that the issuing a report at sep 3) is done after prompting 
a petition to the user of the local computer and obtaining an authorization to send the issued 
report [column 5, lines 51-62]. 

Claim Rejections - 35 USC §103 

The following is a quotation of 35 U.S.C. 1 03(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

9. Claim 32 is rejected under 35 U.S.C. 103(a) as being unpatentable over Parish et al U.S. 
Patent No. 7,3 1 0,8 1 8 B 1 (hereinafter Parish) as applied to claim 1 above, and further in view of 
Rogers et al US 2002/0083334 Al (hereinafter Rogers). 

As to claim 32, Parish discloses the geographical location of the local computers, as 
discussed above. 

Parish does not teach that information about the computer operating system of the local 
computers is included in the issued reports of step d). 

Rogers teaches obtaining information about a computer's operating system during a virus 
scan [0018]. 
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Therefore, it would have been obvious to a person having ordinary skill in the art at the 
time the invention was made to have modified Parish so that information about the computer 
operation system would have been included in the issued reports. 

It would have been obvious to a person having ordinary skill in the art at the time the 
invention was made to have modified Parish by the teaching of Rogers because it is well known 
that certain operating systems are vulnerable to certain attacks and viruses so to know the 
operating system it will make is easier to determine that viruses that might attack it [0008]. 
Conclusion 

10. Applicant's amendment necessitated the new ground(s) of rejection presented in this 
Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). 
Applicant is reminded of the extension of time policy as set forth in 37 CFR 1 .136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the date of this 
final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Aravind K. Moorthy whose telephone number is 571-272-3793. 
The examiner can normally be reached on Monday-Friday, 8:00-5:30. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz R. Sheikh can be reached on 571-272-3795. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 
like assistance from a USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

/Aravind K Moorthy/ 
Examiner, Art Unit 2131 

/Ayaz R. Sheikh/ 

Supervisory Patent Examiner, Art Unit 2131 
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